AI Agent Rebuilds a Danfoss Exploit in 28 Minutes for $6
Claroty Team82 used an AI coding agent to reproduce exploits against Danfoss AK-SM 800A controllers from already-disclosed vulnerabilities. The gap between disclosure and practical exploitation is shrinking, and Internet-exposed devices feel it first.
According to Industrial Cyber on October 19, 2026, the Claroty Team82 research group used an AI-based coding agent to reproduce three vulnerabilities in Danfoss AK-SM 800A refrigeration controllers. The vulnerabilities had already been disclosed. The result: roughly 28 minutes from initial analysis to a working exploit, with an AI usage cost of about US$6.
What was done
The researchers chained two of the vulnerabilities to achieve root-level command execution on a lab device. The agent was Anthropic's Claude Sonnet 4.6 at medium reasoning effort, run through the Cursor editor. The inputs were exclusively public: the firmware, downloaded from the Danfoss website without registration or encryption, the CVE identifiers, the vulnerability classifications, and analysis tools.
The agent reproduced CVE-2025-41451 and CVE-2025-41452 on its own. It got the authentication bypass, CVE-2025-41450, wrong, confidently pursuing an incorrect approach. The researchers redirected it and gave it a Model Context Protocol integration with Ghidra, which enabled targeted decompilation and cross-reference analysis of the 67 MB main binary. At that point the agent reproduced the bypass and combined it with a command injection to obtain root privileges.
The limits of the experiment
Team82 is explicit: this is not autonomous vulnerability discovery from scratch. The work relied on public disclosures and on humans correcting the agent's mistakes. According to the team, the researcher remains essential: to recognize wrong results, ask the right questions, and validate the outcome. Even so, the manual analysis effort was substantially reduced.
The point is not that AI finds new flaws, but that it lowers the time, cost and expertise needed to turn a known vulnerability into an exploit.
Why it matters for Internet exposure
Quick searches on Censys and Shodan identified thousands of potentially exposed devices, reachable without the attacker first having to breach the organization's network. The analysis's author, Amir Zaltzman, points to the recent attacks on French supermarket refrigeration as an example of how a single insecure, Internet-reachable asset can cause real damage, such as food waste and financial losses. We covered that incident in an earlier post on this blog.
What OT and IT leaders should take from this
The practical consequence is that patching windows for known OT CVEs are shrinking. Freely downloadable firmware and online-visible controllers are a real exposure. There are three concrete responses:
- Asset inventory: know which controllers exist, what firmware they run, and which are reachable from the outside.
- Eliminate direct Internet exposure: check, using the same tools attackers use, such as Censys and Shodan, what is visible of your perimeter.
- Segmentation and secure remote access: where remote access is needed, route it through controlled channels instead of exposing the device.
We were unable to verify the full remediation guidance or any response from Danfoss here; for those aspects, consult the Team82 post and the manufacturer's advisories directly. The underlying message holds: if a known vulnerability can be exploited faster and at minimal cost, reducing the exposed attack surface becomes more urgent than chasing every individual patch.